* build: update yarn from 4.12.0 to 4.18.0
Bumps the vendored yarn release (and the DEPS hook, .yarnrc.yml,
script/yarn.js and packageManager references to it) to 4.18.0.
.yarn/releases/yarn-4.18.0.cjs is bin/yarn.js from @yarnpkg/cli-dist@4.18.0
unmodified. The lockfile only changes its metadata version.
Among other fixes, 4.18's built-in TypeScript compatibility patch knows
about the TypeScript 7 package layout; 4.12 fails the fetch step with
ENOENT on lib/_tsc.js when asked to install typescript@7.
* build: bump the nan test lockfile to yarn 4.18's metadata version
The nan spec runner installs nan's test dependencies with the vendored
yarn in immutable mode, and yarn 4.18 refuses the install because it
wants to rewrite the lockfile's metadata version from 8 to 10. Regenerate
the lockfile in the nan patch with 4.18 so the install is a no-op again.
---------
Co-authored-by: Claude <noreply@anthropic.com>
* build: drop unused dev dependencies and the abstract-socket native module
Removes dependencies that nothing in the tree uses any more:
* sinon / @types/sinon: no spec imports them.
* check-for-leaks: only wired to `prepack`, and the root package is
private and never packed.
* null-loader: the only rule using it matched against an always-empty
`ignoredModules` list in the webpack config.
* @types/uuid: uuid ships its own types since well before the version
we depend on.
* q, coffeescript, mkdirp: each backed a single test of third-party
module behaviour. The `require` app-directory test now uses
dirty-chai (any module that only lives in spec/node_modules works,
it is exercising module.paths, not the module), and the mkdirp asar
test is replaced by a `fs.mkdirSync(..., { recursive: true })` case
next to the existing mkdirSync test.
Also drops abstract-socket. dbus-native only used it to connect to
`unix:abstract=` bus addresses, and Node.js has supported abstract
sockets natively via a leading NUL byte since 20.8, so dbus-native is
now patched to use net.createConnection instead. That lets us delete
the abstract-socket patch, its resolutions entry, the dependenciesMeta
`built` opt-in, the packageExtensions block in .yarnrc.yml and the
Linux-only `npm rebuild abstract-socket` step in the spec runner.
abstract-socket itself still appears in the lockfile as dbus-native's
optional dependency (patches cannot change resolution), but it is no
longer built or required by anything.
No-Verification-Needed: dependency, test and build-tooling changes only; no product source touched
* build: replace uuid, basic-auth and temp with Node.js built-ins
* uuid -> crypto.randomUUID() across the specs.
* basic-auth -> a small parseBasicAuth() helper in spec/lib/net-helpers,
used by the two specs that need to read Basic credentials.
* temp -> fs.mkdtempSync in release.ts and in the asar copyFile specs.
Also removes script/doc-only-change.js, whose last caller went away with
the AppVeyor configs.
No-Verification-Needed: spec, release-tooling and manifest changes only; no product source touched
* build: use webpack's BannerPlugin instead of wrapper-webpack-plugin
wrapper-webpack-plugin is a webpack 4 era plugin that still hooks the
deprecated optimizeChunkAssets hook. webpack 5's built-in BannerPlugin
can prepend a raw header and (with `footer: true`) append a raw footer,
and instances run in registration order, so the profiling wrapper and
the try/catch wrapper nest exactly as before. The only difference in the
emitted bundles is a newline between each wrapper and the bundle body.
No-Verification-Needed: webpack build config only; emitted bundle diffed against the previous plugin's output (whitespace-only), production output checked for nesting and syntax
* build: vendor the default app's octicons
The default app uses five icons and an 88 byte stylesheet out of
@primer/octicons, and pulling them out of node_modules was the only
place the GN build reached into node_modules for shipped content. Copy
the files (MIT licensed, notice included alongside) into
default_app/octicon so they are plain static sources like the rest of
the default app, and drop the dependency and the extra copy target. The
files end up at the same paths inside default_app.asar as before.
No-Verification-Needed: vendored files are byte-identical to the octicon files the existing build already ships at the same asar paths
* build: drop got and dedupe @electron/fiddle-core
The release scripts were the only direct users of got, and every call
was a plain GET/HEAD/POST that global fetch covers: HEAD requests use
`redirect: 'manual'` in place of `followRedirect: false`, and the
non-2xx handling that previously relied on `throwHttpErrors: false` now
checks `response.status` explicitly. The asset manifest in release.ts is
untouched.
got@11 was also still being kept alive by @electron/fiddle-core@1, which
the root package depended on while .github/workflows already used ^2.
Aligning the root on ^2 removes the second copy of fiddle-core and
@electron/get along with the whole got@11 dependency chain (41 packages).
fiddle-core 2 is ESM-only; the CommonJS spec runner loads it through
require(esm), which is available on the Node 22.21 CI uses and anything
newer than 22.12.
No-Verification-Needed: release tooling, spec runner and manifest changes only; no product source touched
* test: replace express in the autoUpdater specs with a small router
The two autoUpdater specs were the only users of express, and between
them they use `use()`, `get()` with one `:param` route, `res.status()`,
`res.send()`, `res.json()` and `res.download()`. spec/lib/http-server-
helpers.ts provides exactly that surface on top of node:http, with file
responses still going through `send` (what express uses internally) so
HEAD, Range and content-type behaviour towards the updaters is unchanged.
`send` is bumped to the 1.x line express 5 was already using, since 0.x
serves .msix files as application/octet-stream rather than
application/msix.
Removes express, @types/express and 43 transitive packages.
No-Verification-Needed: spec-only change; helper exercised over HTTP for GET/HEAD/Range/json/204/404 routing
* test: depend on resedit directly instead of @electron/packager
The asar integrity spec only used @electron/packager for its resedit
wrapper, and only the branch of that wrapper which embeds the integrity
resource on Windows. Do that directly with resedit (the library the
wrapper is built on), which is a dozen lines, and drop packager along
with the 24 signing/notarizing/downloading packages it brings in.
No-Verification-Needed: spec-only change; resource embedding round-tripped against a real PE locally
* test: replace the last temp usage in the protocol code cache spec
The `temp` package was dropped from the root package.json but
api-protocol-spec.ts still required it inline, so every test shard
that loads that file failed at spec-runner startup.
No-Verification-Needed: test-only change
The deepak1556/node-abstractsocket fork carries an N-API rewrite and
cross-OS install support on top of the unpublished upstream v2.1.1.
Neither change exists on npm (latest is 2.0.0) or in upstream git, so
vendoring the diff as a yarn patch removes the external git dependency
while keeping the same code.
Yarn's patch: protocol ignores dependency and os edits in the patched
manifest, so node-addon-api is added via packageExtensions instead. The
original os=linux condition is left in place; under Yarn Berry it simply
skips linking on other platforms, which is what we want for a Linux-only
dbus test dep.
